pulumi/pulumi · error

opening ESC environments: %w

Error message

opening ESC environments: %w

What it means

localPolicyEnvironmentResolver.ResolveEnvironments opens a synthetic ESC environment importing the environments passed to a local policy pack. An error returned from OpenYAMLEnvironment (transport failure, client error) is wrapped here. Unlike 168, this path reports hard errors rather than evaluation diagnostics.

Source

Thrown at pkg/backend/httpstate/policypack.go:301

	envs backend.EnvironmentsBackend,
	orgName string,
) engine.PolicyEnvironmentResolver {
	return &localPolicyEnvironmentResolver{envs: envs, orgName: orgName}
}

func (r *localPolicyEnvironmentResolver) ResolveEnvironments(
	ctx context.Context,
	environments []string,
) (*engine.ResolvedPolicyEnvironment, error) {
	if len(environments) == 0 {
		return nil, nil
	}

	yaml := workspace.NewEnvironment(environments).Definition()

	env, diags, err := r.envs.OpenYAMLEnvironment(ctx, r.orgName, yaml, 2*time.Hour, nil)
	if err != nil {
		return nil, fmt.Errorf("opening ESC environments: %w", err)
	}
	if len(diags) != 0 {
		var diagMsgs strings.Builder
		for _, d := range diags {
			fmt.Fprintf(&diagMsgs, "  %s\n", d.Summary)
		}
		return nil, fmt.Errorf("opening ESC environments:\n%s", diagMsgs.String())
	}

	result := &engine.ResolvedPolicyEnvironment{}

	if policyConfigVal, ok := env.Properties["policyConfig"]; ok {
		policyConfig, err := escValueToConfigMap(policyConfigVal)
		if err != nil {
			return nil, fmt.Errorf("extracting policyConfig from ESC environment: %w", err)
		}
		result.Config = policyConfig
	}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Check connectivity to Pulumi Cloud (`curl -sI https://api.pulumi.com`).
2. Verify login: `pulumi whoami` and re-run `pulumi login`.
3. Confirm the org name in the URL/config is correct.
4. Check proxy env vars (HTTPS_PROXY) and corporate CA configuration.

Example fix

// before (unreachable endpoint)
export PULUMI_API=https://pulumi.internal.example.com
// after
pulumi login https://api.pulumi.com

// preflight connectivity
if resp, err := http.Get("https://api.pulumi.com"); err != nil {
    return fmt.Errorf("Pulumi Cloud unreachable: %w", err)
} else { resp.Body.Close() }

null

var resolved *engine.ResolvedPolicyEnvironment
err := policy.ResolveEnvironments(ctx)
if err != nil && strings.Contains(err.Error(), "opening ESC environments:") {
    // transient network errors: retry with backoff
    time.Sleep(time.Second * 5)
    resolved, err = retryResolve(ctx, policy, 3)
}

When it happens

Trigger: A policy pack run specifies ESC environments and r.envs.OpenYAMLEnvironment returns err — unreachable Pulumi Cloud endpoint, invalid org name, or the environment import fails at the API level.

Common situations: Offline or proxied CI that cannot reach Pulumi Cloud; wrong org name configured; token expired mid-session; DNS/network failures.

Related errors

• opening ESC environments for policy pack %q: %w
• reading response from API: %w
• opening ESC environments for policy pack %q: %s
• preparing ESC environment for policy pack %q: %w
• opening ESC environments: %s

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/3f14a79b145829ef. Report an issue: GitHub.